PT-2017-14126

CVE-2017-15602

·

Published

2017-10-17

·

Updated

2020-11-23

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions GNU Libextractor version 1.4
Description The issue is caused by an integer signedness error for the chunk size in the EXTRACTOR nsfe extract method function, located in plugins/nsfe extractor.c. This error can lead to an infinite loop when a crafted size is encountered.
Recommendations For GNU Libextractor version 1.4, consider applying a patch to fix the integer signedness error in the EXTRACTOR nsfe extract method function to prevent infinite loops for crafted chunk sizes.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')
Related identifiers
CVE-2017-15602
ALT-PU-2017-2450
DLA-1198-1
USN-4641-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com